Merchants decide how much to place on hold for authorizations and the issuing bank makes a decision on how long to place the hold,

It's our decision on what the hold time is, but for a credit card, the hold period can be up to five days, ... But we remove the hold if the transaction comes in sooner.

We have notified some card customers that their information may have been compromised.

We are in the process of notifying some customers.

Customer data may have been compromised as a third-party unrelated to Bank of America. As standard procedure, if we see misuse, or the potential for misuse, we do not only notify the customer but block the card.

It's standard procedure to do this if we see misuse or potential misuse of a customer's card. We can block them and reissue new cards.